[Bug] "Could not find a WAM account for the silent request." for AcquireTokenSilent in UWP application.

[bkaankose]

Library version used

4.57.0

.NET version

.NET Standard 2.0

Scenario

PublicClient - desktop app

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

I have an UWP application and a .NET Standard 2.0 library. MSAL authentication is done in this .NET standard library, from a call in UWP application.

My first authentication goes fine. I'm able to run a native dialog, login with WAM and use the token until it expires. When the token is expired, by code does a silent refresh. This is the part that MSAL fails.

I receive the following error "Could not find a WAM account for the silent request."

When I run

await _publicClientApplication.GetAccountsAsync()

I'm able to see the same account that was cached. It's there but MSAL fails to find it and fails to refresh the token.
 
This is how I configure my public client application in the .NET Standard library:

            var authenticationRedirectUri = nativeAppService.GetWebAuthenticationBrokerUri();
            var redirectUri= string.Format("ms-appx-web://Microsoft.AAD.BrokerPlugIn/{0}", authenticationRedirectUri);
            var brokerOptions = new BrokerOptions(BrokerOptions.OperatingSystems.Windows);

            _publicClientApplication =
                PublicClientApplicationBuilder.Create(ClientId)
                .WithRedirectUri(redirectUri)
                .WithBroker(brokerOptions)
                .WithLogging((x, y, z) => Log.Information($"{x} {y}"), LogLevel.Verbose, true)
                .Build();

Here are the logs that are generated by MSAL:

2023-11-19 01:11:04.431 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Cache Session Manager] Entering the cache semaphore. Real semaphore: True. Count: 1
2023-11-19 01:11:04.432 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Cache Session Manager] Entered cache semaphore
2023-11-19 01:11:04.438 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] OnBeforeAccessAsync - before getting the lock 1
2023-11-19 01:11:04.439 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] OnBeforeAccessAsync - acquired the lock
2023-11-19 01:11:04.541 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] OnAfterAccessAsync - released the lock
2023-11-19 01:11:04.543 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Cache Session Manager] Released cache semaphore
2023-11-19 01:11:04.551 +01:00 [INF] Always True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] [Internal cache] Total number of cache partitions found while getting refresh tokens: 0
2023-11-19 01:11:04.554 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [GetAccounts] Found 0 RTs and 1 accounts in MSAL cache. 
2023-11-19 01:11:04.555 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] IsLegacyAdalCacheEnabled: yes
2023-11-19 01:11:04.564 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Region discovery] Not using a regional authority. 
2023-11-19 01:11:04.565 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? False. 
2023-11-19 01:11:04.567 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Instance Discovery] Tried to use known metadata provider for login.microsoftonline.com. Success? True. 
2023-11-19 01:11:04.568 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [GetAccounts] Found 0 RTs and 1 accounts in MSAL cache after environment filtering. 
2023-11-19 01:11:04.569 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] IsLegacyAdalCacheEnabled: yes
2023-11-19 01:11:04.574 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Region discovery] Not using a regional authority. 
2023-11-19 01:11:04.575 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? False. 
2023-11-19 01:11:04.576 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] [Instance Discovery] Tried to use known metadata provider for login.microsoftonline.com. Success? True. 
2023-11-19 01:11:04.577 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - b456c2d1-1e5c-4eea-b5a9-466a36d2f79e] IsLegacyAdalCacheEnabled: yes
2023-11-19 01:11:04.582 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] [WAM Broker] Authority is AAD. Using WAM Broker. 
2023-11-19 01:11:04.586 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Starting WamBroker:GetAccountsAsync
2023-11-19 01:11:04.587 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] WAM::FindAllAccountsAsync returning no accounts due to configuration option
2023-11-19 01:11:04.588 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Finished WamBroker:GetAccountsAsync in 2 ms
2023-11-19 01:11:04.591 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Filtering broker accounts by environment. Before filtering: 0
2023-11-19 01:11:04.592 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - f5dbc37f-d956-4e98-b003-eda8171d234f] [Region discovery] Not using a regional authority. 
2023-11-19 01:11:04.593 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - f5dbc37f-d956-4e98-b003-eda8171d234f] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? False. 
2023-11-19 01:11:04.594 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - f5dbc37f-d956-4e98-b003-eda8171d234f] [Instance Discovery] Tried to use known metadata provider for login.microsoftonline.com. Success? True. 
2023-11-19 01:11:04.595 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] After filtering: 0
2023-11-19 01:11:04.596 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Found 1 cache accounts and 0 broker accounts
2023-11-19 01:11:04.597 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Returning 1 accounts
2023-11-19 01:11:04.599 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Cache Session Manager] Entering the cache semaphore. Real semaphore: True. Count: 1
2023-11-19 01:11:04.600 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Cache Session Manager] Entered cache semaphore
2023-11-19 01:11:04.601 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] OnBeforeAccessAsync - before getting the lock 1
2023-11-19 01:11:04.602 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] OnBeforeAccessAsync - acquired the lock
2023-11-19 01:11:04.605 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] OnAfterAccessAsync - released the lock
2023-11-19 01:11:04.606 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Cache Session Manager] Released cache semaphore
2023-11-19 01:11:04.607 +01:00 [INF] Always True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] [Internal cache] Total number of cache partitions found while getting refresh tokens: 0
2023-11-19 01:11:04.608 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [GetAccounts] Found 0 RTs and 1 accounts in MSAL cache. 
2023-11-19 01:11:04.609 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] IsLegacyAdalCacheEnabled: yes
2023-11-19 01:11:04.610 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Region discovery] Not using a regional authority. 
2023-11-19 01:11:04.611 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? False. 
2023-11-19 01:11:04.612 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Instance Discovery] Tried to use known metadata provider for login.microsoftonline.com. Success? True. 
2023-11-19 01:11:04.613 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [GetAccounts] Found 0 RTs and 1 accounts in MSAL cache after environment filtering. 
2023-11-19 01:11:04.614 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] IsLegacyAdalCacheEnabled: yes
2023-11-19 01:11:04.615 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Region discovery] Not using a regional authority. 
2023-11-19 01:11:04.616 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? False. 
2023-11-19 01:11:04.617 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] [Instance Discovery] Tried to use known metadata provider for login.microsoftonline.com. Success? True. 
2023-11-19 01:11:04.618 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 79340235-725e-443d-b332-0f9340eca0ae] IsLegacyAdalCacheEnabled: yes
2023-11-19 01:11:04.619 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] [WAM Broker] Authority is AAD. Using WAM Broker. 
2023-11-19 01:11:04.620 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Starting WamBroker:GetAccountsAsync
2023-11-19 01:11:04.621 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] WAM::FindAllAccountsAsync returning no accounts due to configuration option
2023-11-19 01:11:04.622 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Finished WamBroker:GetAccountsAsync in 2 ms
2023-11-19 01:11:04.623 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Filtering broker accounts by environment. Before filtering: 0
2023-11-19 01:11:04.624 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 17d5bfb8-fdac-4396-bcaf-1fa6b0f89580] [Region discovery] Not using a regional authority. 
2023-11-19 01:11:04.625 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 17d5bfb8-fdac-4396-bcaf-1fa6b0f89580] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? False. 
2023-11-19 01:11:04.626 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z - 17d5bfb8-fdac-4396-bcaf-1fa6b0f89580] [Instance Discovery] Tried to use known metadata provider for login.microsoftonline.com. Success? True. 
2023-11-19 01:11:04.627 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] After filtering: 0
2023-11-19 01:11:04.628 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Found 1 cache accounts and 0 broker accounts
2023-11-19 01:11:04.629 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:04Z] Returning 1 accounts
2023-11-19 01:11:05.913 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] MSAL MSAL.UAP with assembly version '4.57.0.0'. CorrelationId(c54692e0-8cdc-4809-96d9-5f3f315d2cd6)
2023-11-19 01:11:05.916 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] === AcquireTokenSilent Parameters ===
2023-11-19 01:11:05.917 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] LoginHint provided: False
2023-11-19 01:11:05.918 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] Account provided: Account username: bkaankose@outlook.com environment login.windows.net home account id: AccountId: 00000000-0000-0000-cd01-c7fa9e26f386.9188040d-6c67-4c5b-b112-36a304b66dad
2023-11-19 01:11:05.919 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] ForceRefresh: False
2023-11-19 01:11:05.924 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] 
=== Request Data ===
Authority Provided? - True
Client Id - b19c2035-d740-49ff-b297-de6ec561b208
Scopes - email mail.readwrite offline_access mail.send
Redirect Uri - ms-appx-web://Microsoft.AAD.BrokerPlugIn/S-1-15-2-696226386-2013995017-2875520088-1190820237-1689755563-2911291344-762345214
Extra Query Params Keys (space separated) - 
ClaimsAndClientCapabilities - 
Authority - https://login.microsoftonline.com/common/
ApiId - AcquireTokenSilent
IsConfidentialClient - False
SendX5C - False
LoginHint - 
IsBrokerConfigured - True
HomeAccountId - 
CorrelationId - c54692e0-8cdc-4809-96d9-5f3f315d2cd6
UserAssertion set: False
LongRunningOboCacheKey set: False
Region configured: 

2023-11-19 01:11:05.925 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] === Token Acquisition (SilentRequest) started:
	Authority: https://login.microsoftonline.com/common/
	Scope: email mail.readwrite offline_access mail.send
	ClientId: b19c2035-d740-49ff-b297-de6ec561b208
	
2023-11-19 01:11:05.931 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] Broker is configured and enabled, attempting to use broker instead.
2023-11-19 01:11:05.934 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] [WAM Broker] Authority is AAD. Using WAM Broker. 
2023-11-19 01:11:05.936 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] Can invoke broker. Will attempt to acquire token with broker. 
2023-11-19 01:11:05.940 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] Starting WamBroker:AcquireTokenSilentAsync
2023-11-19 01:11:05.943 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] [WAM Broker] Authority tenant is consumers. Using WAM-MSA 
2023-11-19 01:11:05.965 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] WAM will try to find an account based on the WAM account id from the cache
2023-11-19 01:11:05.968 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] Starting WAM:FindAccountAsync:
2023-11-19 01:11:05.969 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] === WebAccountProvider ===
Authority consumers
DisplayName Microsoft account
Id https://login.microsoft.com

2023-11-19 01:11:05.980 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] Finished WAM:FindAccountAsync: in 11 ms
2023-11-19 01:11:05.982 +01:00 [INF] Warning True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] WAM account was not found for given WAM account id.
2023-11-19 01:11:05.984 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] Starting WAM:FindAllWebAccountsAsync:
2023-11-19 01:11:05.986 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:05Z] === WebAccountProvider ===
Authority consumers
DisplayName Microsoft account
Id https://login.microsoft.com

2023-11-19 01:11:06.000 +01:00 [INF] Info True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:06Z] [WAM Proxy] WebAuthenticationCoreManager.FindAllAccountsAsync failed  with error code 2147942405 error message Error and status NotAllowedByProvider
2023-11-19 01:11:06.002 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:06Z] Finished WAM:FindAllWebAccountsAsync: in 17 ms
2023-11-19 01:11:06.004 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:06Z] Finished WamBroker:AcquireTokenSilentAsync in 63 ms
2023-11-19 01:11:06.007 +01:00 [INF] Verbose True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:06Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] Broker could not satisfy silent request.
2023-11-19 01:11:06.036 +01:00 [INF] Error True MSAL 4.57.0.0 MSAL.UAP .NET Core 4.6.31331.01 Windows 10 [2023-11-19 00:11:06Z - c54692e0-8cdc-4809-96d9-5f3f315d2cd6] MSAL.UAP.4.57.0.0.MsalUiRequiredException: 
	ErrorCode: interaction_required
Microsoft.Identity.Client.MsalUiRequiredException: Could not find a WAM account for the silent request.
   at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken)
   at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
	StatusCode: 0 
	ResponseBody:  
	Headers: 

Relevant code snippets

No response

Expected behavior

No response

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

I can disable Windows broker options and it will work fine with old web authentication broker. I just want to use the native authentication broker dialog and integrated Windows login screen for authentication.

[bgavrilMS]

Just to set expectations, there are quite a few WAM bugs reported recently on win32 apps, and those are a priority for the team over UWP. Please consider moving from UWP to WinUI...

[nbevans]

Pretty sure we're also seeing this. It appears that its sometimes unable to do a silent refresh of the token via WAM.

This line of code is getting hit. But this doesn't seem right to me? Shouldn't ListWindowsWorkAndSchoolAccounts = true if using AAD with organizations tenant?
_logger.Info("WAM::FindAllAccountsAsync returning no accounts due to configuration option");

[nbevans]

I think our problem may actually be slightly different (but still relevant).

As per basically all sample code for MSAL - we call GetAccountsAsync() prior to AcquireTokenSilent(). The purpose of the GetAccountsAsync() call is to get the "first" account, so as to have an input for the 2nd parameter on AcquireTokenSilent() (an IAccount or loginHint string). In our case, we go further than just finding the "first" account - we search for a matching account that meets our expected account ID - as an additional security precaution.

The problem is likely because WAM doesn't provide Refresh Tokens into the MSAL user cache - but GetAccountsAsync() is (for some "privacy" reasons according to a code comment) defaulted to exclude Work and School Accounts. So our call to GetAccountsAsync() will only work whilst the token temporarily exists in the MSAL user cache. Once the access token has expired, GetAccountsAsync() needs to talk to WAM but it cannot because Work and School Accounts are excluded and the function returns an empty array.

I am trying a fix whereby if GetAccountsAsync() returns no matching accounts, then we will still call AcquireTokenSilent() anyway, but this time passing in a loginHint string instead (a UPN).

[nbevans]

No that didn't work.

Eventually, GetAccountsAsync() returns an empty list.

Passing in a loginHint instead will also result in the following exception.

Exception type: Microsoft.Identity.Client.MsalUiRequiredException 
[21748] , ErrorCode: no_account_for_login_hint 
[21748] HTTP StatusCode 0 
[21748] CorrelationId  
[21748]  
[21748]    at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.GetSingleAccountForLoginHintAsync(String loginHint) 
[21748]    at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.GetAccountFromParamsOrLoginHintAsync(IAccount account, String loginHint) 
[21748]    at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.UpdateRequestWithAccountAsync() 
[21748]    at Microsoft.Identity.Client.Internal.Requests.Silent.SilentRequest.ExecuteAsync(CancellationToken cancellationToken) 
[21748]    at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken) 

I've tried configuring the broker to include OS/work/school accounts as follows but this also seems to be ignored:

.WithBroker(new BrokerOptions(BrokerOptions.OperatingSystems.Windows) { ListOperatingSystemAccounts = true });

... still produces this warning trace output:

WAM::FindAllAccountsAsync returning no accounts due to configuration option 

This thing seems to be full of bugs?

[nbevans]

It seems the UAP broker doesn't honour the BrokerOptions as the code checks for UwpBrokerOptions (which cannot be and is not set by anything in newer versions)

I used reflection to set UwpBrokerOptions on the ApplicationConfiguration object. I verified with VS debugger that it was indeed set so that ListWorkAndSchoolAccounts = true and a HeaderText for extra points.

I re-ran the auth process and was now seeing this:

[WAM Proxy] WebAuthenticationCoreManager.FindAllAccountsAsync failed  with error code 2147942405 error message Access is denied. and status NotAllowedByProvider 

So it seems enabling the work/school accounts mode by force also doesn't help. I guess that's why the UAP broker doesn't honour this setting.

So it does appear the UAP WAM broker is faulty. It will always sign you out eventually when doing a silent request by throwing a UiRequiredException eventually. I am talking like less than 12 hours. There is no logical reason for it to do this. The organisation account is the PRT account on the machine. It says "Connected with Windows" on the account picker displayed by the broker. The app registration /.default includes offline_access scope.

[bgavrilMS]

Hi @nbevans - the option to "ListWindowsWorkAndSchoolAccounts" is not needed and most apps are anyway prevented from actually discovering accounts for privacy reasons. We are considering removing it because it causes too much confusion.

The ideal pattern to use with WAM and get SSO with Windows (i.e. silently login the current Windows user) is described at https://aka.ms/msal-net-wam. In particular, pay attention to OperatingSystemAccount

Does this pattern not work for you?

IEnumerable<IAccount> accounts = await app.GetAccountsAsync();
IAccount existingAccount = accounts.FirstOrDefault();

try
{    
    if (existingAccount != null)
    {
        result = await app.AcquireTokenSilent(scopes, existingAccount).ExecuteAsync();
    }
    // Next, try to sign in silently with the account that the user is signed into Windows
    else
    {    
        result = await app.AcquireTokenSilent(scopes, PublicClientApplication.OperatingSystemAccount)
                            .ExecuteAsync();
    }
}
// Can't get a token silently, go interactive
catch (MsalUiRequiredException ex)
{
    result = await app.AcquireTokenInteractive(scopes).ExecuteAsync();
}

If you don't want to get SSO with Windows, just remove the AcquireTokenSilent(scopes, PublicClientApplication.OperatingSystemAccount) - doesn't that work?

[nbevans]

Thanks for your reply, it is highly appreciated!

I have taken a look at your suggestion.

Signing into the PublicClientApplication.OperatingSystemAccount as a fallback seems like a potential security issue.

They might be signed into Windows with Account A. But deliberately signed into our app using Account B. If our app then "silently" switches them to Account A because GetAccountsAsync() suddenly returned no results... this might be considered a very surprising and unexpected behaviour?

I guess I could implement a safeguard to verify the returned IAccount matches our expected one and, if not, then do a RemoveAsync() call and throw an exception about the unexpected account. But whilst this solves the security issue, it still leaves open the issue that in this scenario the user is going to get signed out and require Interactive auth again.

I am currently trying the following:

var credentialAccount = (await app.GetAccountsAsync()).FirstOrDefault(candidateAccount => candidateAccount.HomeAccountId.Identifier == expectedUniqueAccountIdentifier);
var result = credentialAccount != null ? await app.AcquireTokenSilent(scopes, credentialAccount).ExecuteAsync() : await app.AcquireTokenSilent(scopes, PublicClientApplication.OperatingSystemAccount).ExecuteAsync();
if (result.Account.HomeAccountId.Identifier == expectedUniqueAccountIdentifier) {
    return AuthenticateIdentityProviderAuthenticationResult.NewOkay(new AuthenticateIdentityProviderAuthenticationToken(AuthenticateIdentityProviderImpl.MicrosoftIdentity, result.Account.HomeAccountId.Identifier, result.Account.Username, result.CreateAuthorizationHeader()));
} else {
    await app.RemoveAsync(result.Account);
    return AuthenticateIdentityProviderAuthenticationResult.NewReauthenticate(null, "Operating system account was used in silent request but the returned account did not match our expectation.");
}